bin: split the release tooling into a shared release layer - #308

bin/version.ts had grown to eight concerns in one file: the release vocabulary, workspace reading, git and Lerna plumbing, changelog parsing, the version plan and its guards, the pre-flight checks, the writes, and the report. At the same time bin/ already had a shared model, in the wrong place. Six of the eight scripts imported one from publish-tagged.ts: readWorkspaces alone had five import sites, check-changelog.ts depended on the publisher, and packlist.ts was a library nothing executed. version.ts carried its own copy of the same model.

The nouns are now modules in bin/release/, shared by every script that needs them:

• policy.ts: the vocabulary (keywords, identifiers, dist-tags, and the release-tag convention: releaseTag, parseReleaseTag, isReleaseTag)
• git.ts: run, status, tryRun, with no release knowledge
• workspaces.ts: one Workspace model that keeps dependency kinds apart and derives dependencies exactly as before, plus rewriteManifest and topoSort
• lerna.ts, changelog.ts, packlist.ts (moved whole), and schema-versions.ts (from format: stamp info, resources and program objects with their schema and specification version #305)
• plan.ts: the moves and the judgements about them
• apply.ts: the writes, the Publish commit, the tags and the undo advice

No module imports a script, and no script imports another script.

The phases are types. bin/version.ts now reads as surveyRelease (the only read) → decide (pure, returns a Plan that holds the exact bytes to write) → check (pure, returns the errors and findings) → report → applyRelease (the only write). Because the world enters through one reader, the pre-flight findings, the nearest-tag check and the release-tags-at-HEAD exception now have tests from hand-built surveys. They had none before, because they shelled out. applyRelease has its first test too, against a scratch repository, including a failure part-way through tagging.

bin/ is now type-checked: yarn typecheck:bin, with a CI step beside yarn typecheck. The one error it found in the existing code (a narrowing in parseArgs) is fixed in the first commit.

Behavior is unchanged. A dry run of bin/version.ts gives byte-identical output and exit codes against the pre-refactor script for prerelease, patch, minor --all, major --all and a dirty tree. Every commit passes the bin tests and the type-check on its own.

Two things are left as they were, on purpose:

• A workspace counts as released when any @ethdebug/<name>@… tag exists, as before. publish-tagged.ts still counts only semver-valid tags when it picks a dist-tag, as before. No tag in the repository makes the two differ.
• The root package.json has no typescript devDependency, so typecheck:bin uses the hoisted tsc. Pinning it would change hoisting, which is out of scope here.